nemoris 0.1.1 → 0.1.3

package/README.md

@@ -184,7 +184,7 @@ Requires Node.js >= 22.
 git clone https://github.com/amzer24/nemoris.git
 cd nemoris
 npm install
-npm test           # 1179 tests
+npm test           # 1403 tests
 npm run test:e2e   # End-to-end tests
 ```
 

package/SECURITY.md

@@ -38,6 +38,22 @@ We follow responsible disclosure practices. If you report a vulnerability:
 - We will credit you in the release notes (unless you prefer anonymity)
 - We will coordinate disclosure timing with you
 
+## Deployment Boundaries
+
+Nemoris is a single operator, single-user runtime designed to run on your own machine.
+
+It is not designed to be:
+
+- a hardened multi-tenant sandbox
+- a public-facing web service
+- a shared server runtime
+
+For recovery procedures, see [docs/RECOVERY-FLOWS.md](docs/RECOVERY-FLOWS.md).
+
+## Vulnerability Tracking
+
+Known vulnerabilities are tracked via GitHub Security Advisories on this repository.
+
 ## Dependencies
 
 Nemoris keeps dependencies minimal by design. We monitor for known vulnerabilities via `npm audit` and update promptly.

package/config/delivery.toml

@@ -13,7 +13,7 @@ adapter = "openclaw_cli"
 enabled = true
 channel = "telegram"
 account_id = "default"
-chat_id = "7781763328"
+chat_id = "YOUR_CHAT_ID"
 silent = true
 dry_run = true
 
@@ -22,7 +22,7 @@ adapter = "openclaw_cli"
 enabled = false
 channel = "telegram"
 account_id = "default"
-chat_id = "7781763328"
+chat_id = "YOUR_CHAT_ID"
 silent = true
 dry_run = false
 
@@ -43,7 +43,7 @@ adapter = "telegram"
 enabled = false
 channel = "telegram"
 account_id = "default"
-chat_id = "7781763328"
+chat_id = "YOUR_CHAT_ID"
 bot_token_env = "NEMORIS_TELEGRAM_BOT_TOKEN"
 
 [profiles.standalone_operator]

package/config/runtime.toml

@@ -102,8 +102,8 @@ allowed_failure_classes = ["timeout", "provider_loading"]
 bot_token_env = "NEMORIS_TELEGRAM_BOT_TOKEN"
 polling_mode = true
 webhook_url = ""
-operator_chat_id = "7781763328"
-authorized_chat_ids = ["7781763328"]
+operator_chat_id = "YOUR_CHAT_ID"
+authorized_chat_ids = ["YOUR_CHAT_ID"]
 default_agent = "main"
 
 [slack]

package/config/skills/telegram-onboarding-spec.md

@@ -63,7 +63,7 @@ Check if daemon is running:
 ```
   Daemon is running. Send any message to @kodi_nemoris_bot on Telegram...
   Waiting for your message...
-  ✓ Found you                            chat_id: 7781763328, @leeUsername
+  ✓ Found you                            chat_id: YOUR_CHAT_ID, @leeUsername
 ```
 
 - Poll the SQLite state store (`state/active.db`) for the first interactive job row where `source = 'telegram'`
@@ -77,7 +77,7 @@ This avoids any conflict with the daemon's getUpdates polling connection. No `de
 
 ```
   Send any message to @kodi_nemoris_bot on Telegram, then press Enter...
-  ✓ Found you                            chat_id: 7781763328, @leeUsername
+  ✓ Found you                            chat_id: YOUR_CHAT_ID, @leeUsername
 ```
 
 - Reuses existing `whoami(botToken)` function (deleteWebhook → getUpdates → extract chat)
@@ -110,8 +110,8 @@ Writes the `[telegram]` section to `config/runtime.toml`:
 bot_token_env = "NEMORIS_TELEGRAM_BOT_TOKEN"
 polling_mode = true
 webhook_url = ""
-operator_chat_id = "7781763328"
-authorized_chat_ids = ["7781763328"]
+operator_chat_id = "YOUR_CHAT_ID"
+authorized_chat_ids = ["YOUR_CHAT_ID"]
 default_agent = "kodi"
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nemoris",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "type": "module",
   "description": "Personal AI agent runtime — persistent memory, delivery guarantees, task contracts, self-healing. Local-first, no cloud.",
   "license": "MIT",

package/src/onboarding/doctor.js

@@ -6,6 +6,7 @@
  */
 
 import fs from "node:fs";
+import path from "node:path";
 import os from "node:os";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
@@ -528,3 +529,80 @@ export async function runDoctor(
 
   return results;
 }
+
+export function quickValidateConfig(installDir) {
+  const errors = [];
+  const suggestions = [];
+  const configDir = path.join(installDir, "config");
+
+  if (!fs.existsSync(path.join(configDir, "runtime.toml"))) {
+    errors.push("Missing config/runtime.toml");
+    suggestions.push("Run `nemoris setup` to regenerate config files.");
+  }
+
+  if (!fs.existsSync(path.join(configDir, "router.toml"))) {
+    errors.push("Missing config/router.toml");
+    suggestions.push("Run `nemoris setup` to regenerate the router.");
+  }
+
+  const providersDir = path.join(configDir, "providers");
+  if (!fs.existsSync(providersDir)) {
+    errors.push("No provider configs found");
+    suggestions.push("Run `nemoris setup` to configure a provider.");
+  } else {
+    const files = fs.readdirSync(providersDir).filter((f) => f.endsWith(".toml"));
+    if (files.length === 0) {
+      errors.push("No provider configs found in config/providers/");
+      suggestions.push("Run `nemoris setup` to configure a provider.");
+    }
+    for (const file of files) {
+      try {
+        const content = fs.readFileSync(path.join(providersDir, file), "utf8");
+        const authRefMatch = content.match(/auth_ref\s*=\s*"([^"]+)"/);
+        if (authRefMatch) {
+          const authRef = authRefMatch[1];
+          if (!authRef.startsWith("env:") && !authRef.startsWith("profile:")) {
+            errors.push(`Invalid auth_ref in ${file}: "${authRef}" (must start with env: or profile:)`);
+            suggestions.push(`Fix auth_ref in config/providers/${file}`);
+          } else if (authRef.startsWith("env:")) {
+            const envName = authRef.slice(4);
+            if (!process.env[envName]) {
+              errors.push(`Missing env var ${envName} referenced by ${file}`);
+              suggestions.push(`Set ${envName} in your .env file or environment.`);
+            }
+          }
+        }
+      } catch {
+        errors.push(`Cannot read ${file}`);
+      }
+    }
+  }
+
+  if (!fs.existsSync(path.join(configDir, "identity"))) {
+    errors.push("Missing config/identity/ directory");
+    suggestions.push("Run `nemoris setup` to create identity files.");
+  }
+
+  return { valid: errors.length === 0, errors, suggestions };
+}
+
+export function suggestRepairs(results) {
+  const repairs = [];
+  for (const error of results.errors) {
+    if (error.includes("No provider configs")) {
+      repairs.push({ error, fix: "nemoris setup", description: "Run setup to configure a provider" });
+    } else if (error.includes("Missing config/runtime.toml")) {
+      repairs.push({ error, fix: "nemoris setup", description: "Run setup to regenerate config files" });
+    } else if (error.includes("Missing config/router.toml")) {
+      repairs.push({ error, fix: "nemoris setup", description: "Run setup to regenerate the router" });
+    } else if (error.includes("Invalid auth_ref")) {
+      repairs.push({ error, fix: "Edit the provider TOML file", description: "Fix auth_ref to use env: or profile: prefix" });
+    } else if (error.includes("Missing env var")) {
+      const envVar = error.match(/Missing env var (\S+)/)?.[1] || "the referenced variable";
+      repairs.push({ error, fix: `Set ${envVar} in .env`, description: `Add ${envVar}=your_key to your .env file` });
+    } else if (error.includes("Missing config/identity")) {
+      repairs.push({ error, fix: "nemoris setup", description: "Run setup to create identity files" });
+    }
+  }
+  return repairs;
+}

package/src/onboarding/lock.js

@@ -32,6 +32,19 @@ export function readLock(installDir) {
   }
 }
 
+export function writeWizardMetadata(installDir, metadata) {
+  const lock = readLock(installDir) || {};
+  const updated = {
+    ...lock,
+    lastRunAt: metadata.lastRunAt || new Date().toISOString(),
+    lastRunVersion: metadata.lastRunVersion || "",
+    lastRunCommand: metadata.lastRunCommand || "setup",
+    lastRunMode: metadata.lastRunMode || "quickstart",
+    lastRunFlow: metadata.lastRunFlow || "interactive",
+  };
+  writeLock(installDir, updated);
+}
+
 export function deleteLock(installDir) {
   const p = lockPath(installDir);
   try {

package/src/onboarding/model-catalog-writer.js

@@ -0,0 +1,83 @@
+import fs from "node:fs";
+import path from "node:path";
+
+/**
+ * Writes the model catalog to state/models.json.
+ * @param {string} installDir
+ * @param {string} agentId
+ * @param {Array<object>} models
+ */
+export function writeModelsCatalog(installDir, agentId, models) {
+  const stateDir = path.join(installDir, "state");
+  fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+  const catalogPath = path.join(stateDir, "models.json");
+  const catalog = {
+    version: 1,
+    agentId,
+    updatedAt: new Date().toISOString(),
+    models: models.map((m) => ({
+      id: String(m.id || ""),
+      provider: String(m.provider || ""),
+      displayName: String(m.displayName || m.name || m.id || ""),
+      contextWindow: typeof m.contextWindow === "number" && m.contextWindow > 0 ? m.contextWindow : undefined,
+      reasoning: typeof m.reasoning === "boolean" ? m.reasoning : undefined,
+      inputTypes: Array.isArray(m.inputTypes) ? m.inputTypes : undefined,
+      costTier: m.costTier || undefined,
+      role: m.role || undefined,
+    })),
+  };
+  const content = JSON.stringify(catalog, null, 2) + "\n";
+  const tempPath = `${catalogPath}.${process.pid}.${Date.now()}.tmp`;
+  fs.writeFileSync(tempPath, content, { encoding: "utf8", mode: 0o600 });
+  fs.renameSync(tempPath, catalogPath);
+}
+
+/**
+ * Reads the model catalog from state/models.json.
+ * @param {string} installDir
+ * @returns {{ version: number, agentId: string, updatedAt: string, models: Array<object> } | null}
+ */
+export function readModelsCatalog(installDir) {
+  const catalogPath = path.join(installDir, "state", "models.json");
+  try {
+    const raw = fs.readFileSync(catalogPath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || !Array.isArray(parsed.models)) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Merges curated preset metadata with selected model IDs.
+ * @param {Array<object>} presets - curated presets with { id, label, description }
+ * @param {Array<object>} fetchedModels - fetched models with { id, contextWindow?, name? }
+ * @param {Array<string>} selectedIds - user-selected model IDs
+ * @param {string} provider - provider name
+ * @returns {Array<object>} enriched model entries
+ */
+export function mergeModelMetadata(presets, fetchedModels, selectedIds, provider) {
+  const presetMap = new Map(presets.map((p) => [p.id, p]));
+  const fetchedMap = new Map(fetchedModels.map((m) => [m.id, m]));
+  const MODEL_ROLE_ORDER = ["cheap_interactive", "fallback", "manual_bump"];
+
+  return selectedIds.map((id, index) => {
+    const preset = presetMap.get(id);
+    const fetched = fetchedMap.get(id);
+    const displayId = id
+      .replace(/^openrouter\//, "")
+      .replace(/^openai-codex\//, "")
+      .replace(/^anthropic\//, "");
+
+    return {
+      id,
+      provider,
+      displayName: preset?.label || fetched?.name || displayId,
+      contextWindow: fetched?.contextWindow || undefined,
+      reasoning: fetched?.reasoning || undefined,
+      inputTypes: fetched?.inputTypes || undefined,
+      role: MODEL_ROLE_ORDER[index] || MODEL_ROLE_ORDER.at(-1),
+    };
+  });
+}

package/src/onboarding/model-catalog.js

@@ -169,20 +169,31 @@ export function detectProviderOptions({ env = process.env, ollamaResult = { ok:
     {
       value: "anthropic",
       label: "Anthropic",
-      hint: anthropic.value ? "API key found in env" : "API key required",
+      hint: anthropic.value ? "API key found in env" : "Setup token or API key",
       detected: Boolean(anthropic.value),
+      authMethods: [
+        { value: "token", label: "Setup Token", hint: "From `claude setup-token`" },
+        { value: "api_key", label: "API Key", hint: "From console.anthropic.com" },
+      ],
     },
     {
       value: "openai",
       label: "OpenAI",
       hint: openai.value ? "API key found in env" : "API key or ChatGPT OAuth",
       detected: Boolean(openai.value),
+      authMethods: [
+        { value: "api_key", label: "API Key", hint: "From platform.openai.com" },
+        { value: "oauth", label: "ChatGPT OAuth", hint: "Browser login, refreshable token" },
+      ],
     },
     {
       value: "openrouter",
       label: "OpenRouter",
       hint: openrouter.value ? "API key found" : "One key, 100+ models — openrouter.ai",
       detected: Boolean(openrouter.value),
+      authMethods: [
+        { value: "api_key", label: "API Key", hint: "From openrouter.ai/keys" },
+      ],
     },
     {
       value: "ollama",
@@ -191,12 +202,16 @@ export function detectProviderOptions({ env = process.env, ollamaResult = { ok:
         ? `Local, free — ${ollamaResult.models?.length || 0} models installed`
         : "Local, free — not detected",
       detected: Boolean(ollamaResult.ok),
+      authMethods: [
+        { value: "local", label: "Local", hint: "No auth needed" },
+      ],
     },
     {
       value: "skip",
       label: "Skip for now",
       hint: "Finish setup without provider auth.",
       detected: false,
+      authMethods: [],
     },
   ];
 }

package/src/onboarding/phases/auth.js

@@ -24,7 +24,7 @@ import {
   resolveOpenAICodexAccess,
 } from "../../auth/openai-codex-oauth.js";
 import { getAuthProfile, resolveAuthProfilesPath } from "../../auth/auth-profiles.js";
-import { buildModelSelectionOptions, fetchOpenAIModels } from "../model-catalog.js";
+import { writeModelsCatalog, mergeModelMetadata } from "../model-catalog-writer.js";
 
 const PROVIDER_CONFIGS = {
   anthropic: {
@@ -178,26 +178,43 @@ function providerDisplayName(provider) {
   return provider;
 }
 
-async function fetchProviderModelIds(provider, key, { fetchImpl = globalThis.fetch } = {}) {
-  if (provider === "anthropic") {
-    return PROVIDER_MODEL_PRESETS.anthropic.map((item) => item.id);
-  }
+const OPENAI_CONTEXT_WINDOWS = {
+  "gpt-4.1": 1000000,
+  "gpt-4o": 128000,
+  "gpt-4o-mini": 128000,
+  "o4-mini": 200000,
+  "o3": 200000,
+  "o3-mini": 200000,
+  "o1": 200000,
+  "o1-mini": 128000,
+  "gpt-4-turbo": 128000,
+  "gpt-3.5-turbo": 16385,
+};
 
-  const target = provider === "openrouter"
-    ? {
-        url: "https://openrouter.ai/api/v1/models",
-        headers: { authorization: `Bearer ${key}` },
-      }
-    : provider === "openai"
-      ? {
-          url: "https://api.openai.com/v1/models",
-          headers: { authorization: `Bearer ${key}` },
-        }
-      : null;
+function formatContextWindow(tokens) {
+  if (!tokens || tokens <= 0) return "";
+  if (tokens >= 1000000) return `ctx ${(tokens / 1000000).toFixed(0)}M`;
+  return `ctx ${Math.round(tokens / 1000).toFixed(0)}k`;
+}
 
-  if (!target) {
-    return [];
-  }
+async function fetchProviderModels(provider, key, { fetchImpl = globalThis.fetch } = {}) {
+  const targets = {
+    anthropic: {
+      url: "https://api.anthropic.com/v1/models",
+      headers: { "x-api-key": key, "anthropic-version": "2023-06-01" },
+    },
+    openrouter: {
+      url: "https://openrouter.ai/api/v1/models",
+      headers: { authorization: `Bearer ${key}` },
+    },
+    openai: {
+      url: "https://api.openai.com/v1/models",
+      headers: { authorization: `Bearer ${key}` },
+    },
+  };
+
+  const target = targets[provider];
+  if (!target) return [];
 
   try {
     const response = await fetchImpl(target.url, {
@@ -207,56 +224,91 @@ async function fetchProviderModelIds(provider, key, { fetchImpl = globalThis.fet
     });
     const data = await response.json();
     if (!response.ok) {
-      return [];
+      return (PROVIDER_MODEL_PRESETS[provider] || []).map((item) => ({
+        id: item.id,
+        name: item.label,
+      }));
     }
-    const ids = Array.isArray(data?.data)
-      ? data.data.map((item) => item?.id).filter(Boolean)
-      : [];
-    if (provider === "openrouter") {
-      return ids.map((id) => ensureProviderModelPrefix(provider, id));
-    }
-    if (provider === "openai") {
-      return ids.map((id) => ensureProviderModelPrefix(provider, id));
-    }
-    return ids;
+    const items = Array.isArray(data?.data) ? data.data.filter(Boolean) : [];
+    return items.map((item) => {
+      const rawId = item.id;
+      const prefixedId = ensureProviderModelPrefix(provider, rawId);
+      let contextWindow;
+      let name;
+      let reasoning;
+
+      if (provider === "anthropic") {
+        name = item.display_name || undefined;
+        contextWindow = item.context_window || undefined;
+      } else if (provider === "openrouter") {
+        name = item.name || undefined;
+        contextWindow = item.context_length || undefined;
+      } else if (provider === "openai") {
+        name = undefined;
+        contextWindow = OPENAI_CONTEXT_WINDOWS[rawId] || undefined;
+      }
+
+      return {
+        id: prefixedId,
+        contextWindow,
+        name,
+        reasoning,
+      };
+    });
   } catch {
-    return [];
+    return (PROVIDER_MODEL_PRESETS[provider] || []).map((item) => ({
+      id: item.id,
+      name: item.label,
+    }));
   }
 }
 
 async function buildProviderSelectionOptions(provider, key, { fetchImpl = globalThis.fetch } = {}) {
-  if (provider === "openai") {
-    const discoveredModels = await fetchOpenAIModels(key, { fetchImpl });
-    return buildModelSelectionOptions({
-      provider,
-      discoveredModels,
-      includeKeep: false,
-      includeManual: true,
-    }).map((entry) => ({
-      value: entry.value,
-      label: entry.label,
-      description: entry.hint,
-    }));
-  }
-
   const curated = PROVIDER_MODEL_PRESETS[provider] || [];
-  const available = new Set(await fetchProviderModelIds(provider, key, { fetchImpl }));
-  const selectable = curated.filter((item) => available.size === 0 || available.has(item.id));
-  const options = selectable.length > 0 ? selectable : curated;
-  return options.map((item) => ({
-    value: item.id,
-    label: item.label,
-    description: item.description,
-  }));
+  const fetchedModels = await fetchProviderModels(provider, key, { fetchImpl });
+  const fetchedIds = new Set(fetchedModels.map((m) => m.id));
+  const fetchedMap = new Map(fetchedModels.map((m) => [m.id, m]));
+
+  // Curated models that exist in the fetched list (fall back to all curated if fetch failed)
+  const curatedAvailable = fetchedModels.length > 0
+    ? curated.filter((item) => fetchedIds.has(item.id))
+    : curated;
+  const curatedIds = new Set(curatedAvailable.map((item) => item.id));
+
+  // Remaining fetched models not already shown as curated
+  const extra = fetchedModels
+    .filter((m) => !curatedIds.has(m.id))
+    .map((m) => {
+      const displayId = m.id
+        .replace(/^openrouter\//, "")
+        .replace(/^openai-codex\//, "")
+        .replace(/^anthropic\//, "");
+      const ctxStr = formatContextWindow(m.contextWindow);
+      const desc = ctxStr ? `available from provider \u00b7 ${ctxStr}` : "available from provider";
+      return { value: m.id, label: displayId, description: desc };
+    });
+
+  const options = [
+    ...curatedAvailable.map((item) => {
+      const fetched = fetchedMap.get(item.id);
+      const ctxStr = fetched ? formatContextWindow(fetched.contextWindow) : "";
+      const desc = ctxStr ? `${item.description} \u00b7 ${ctxStr}` : item.description;
+      return { value: item.id, label: item.label, description: desc };
+    }),
+    ...extra,
+    { value: "__custom__", label: "Enter a different model name...", description: "Use a specific model id not shown in the list." },
+  ];
+
+  return { options, fetchedModels };
 }
 
 async function promptForProviderModels(provider, key, tui, { fetchImpl = globalThis.fetch } = {}) {
   const { select, prompt, dim, cyan } = tui;
-  if (!select) return [];
+  if (!select) return { chosen: [], fetchedModels: [] };
 
-  const options = await buildProviderSelectionOptions(provider, key, { fetchImpl });
+  const { options, fetchedModels } = await buildProviderSelectionOptions(provider, key, { fetchImpl });
   const chosen = [];
-  const manualOptionValue = provider === "openai" ? "__manual__" : "__custom__";
+  const manualOptionValue = "__custom__";
   const defaultModelValue = options.find((item) => !String(item.value).startsWith("__"))?.value || "";
 
   console.log(`\n  ${cyan(`Choose ${provider === "openrouter" ? "OpenRouter" : provider === "openai" ? "OpenAI" : "Anthropic"} models`)}`);
@@ -271,19 +323,14 @@ async function promptForProviderModels(provider, key, tui, { fetchImpl = globalT
     }));
 
     if (chosen.length > 0) {
-      pickerOptions.push({
-        label: "Done",
-        value: "__done__",
-        description: "Continue setup with the models already selected.",
-      });
-    }
-
-    if (provider !== "openai") {
-      pickerOptions.push({
-        label: "Enter a different model name...",
-        value: manualOptionValue,
-        description: "Use a specific model id not shown in the curated list.",
-      });
+      // Insert "Done" before the custom-entry option at the end
+      const customIndex = pickerOptions.findIndex((item) => item.value === "__custom__");
+      const doneOption = { label: "Done", value: "__done__", description: "Continue setup with the models already selected." };
+      if (customIndex >= 0) {
+        pickerOptions.splice(customIndex, 0, doneOption);
+      } else {
+        pickerOptions.push(doneOption);
+      }
     }
 
     const picked = await select(
@@ -309,7 +356,7 @@ async function promptForProviderModels(provider, key, tui, { fetchImpl = globalT
     }
   }
 
-  return chosen;
+  return { chosen, fetchedModels };
 }
 
 export function writeProviderConfigs(installDir, providerInput) {
@@ -551,11 +598,31 @@ export async function runAuthPhase(installDir, options = {}) {
     providerFlags.openai = true;
   }
 
+  const fetchedModelsCache = {};
   if (tui) {
     for (const provider of ["openrouter", "anthropic", "openai"]) {
       const providerToken = providerSecrets[provider];
       if (!providerToken) continue;
-      selectedModels[provider] = await promptForProviderModels(provider, providerToken, tui, { fetchImpl });
+      const { chosen, fetchedModels } = await promptForProviderModels(provider, providerToken, tui, { fetchImpl });
+      selectedModels[provider] = chosen;
+      fetchedModelsCache[provider] = fetchedModels;
+    }
+  }
+
+  // Persist model catalog with metadata
+  const allCatalogModels = [];
+  for (const [provider, modelIds] of Object.entries(selectedModels)) {
+    if (!modelIds?.length) continue;
+    const presets = PROVIDER_MODEL_PRESETS[provider] || [];
+    const fetched = fetchedModelsCache[provider] || [];
+    const enriched = mergeModelMetadata(presets, fetched, modelIds, provider);
+    allCatalogModels.push(...enriched);
+  }
+  if (allCatalogModels.length > 0) {
+    try {
+      writeModelsCatalog(installDir, "default", allCatalogModels);
+    } catch {
+      // Non-fatal — catalog is optional
     }
   }
 

package/src/onboarding/wizard.js

@@ -17,6 +17,7 @@ import { verify } from "./phases/verify.js";
 import { createClackPrompter, SetupCancelledError } from "./clack-prompter.js";
 import { detectPreferredProvider, detectProviderOptions, summarizeSelectedModels } from "./model-catalog.js";
 import { isDaemonRunning, loadDaemon, writeDaemonUnit } from "./platform.js";
+import { writeWizardMetadata } from "./lock.js";
 
 const MIN_NODE_MAJOR = 22;
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -63,6 +64,43 @@ function readRuntimeConfig(installDir) {
   }
 }
 
+function readExistingIdentity(installDir) {
+  const result = { userName: "", agentName: "", agentId: "", provider: "" };
+  try {
+    const agentsDir = path.join(installDir, "config", "agents");
+    if (fs.existsSync(agentsDir)) {
+      const files = fs.readdirSync(agentsDir).filter((f) => f.endsWith(".toml"));
+      if (files.length > 0) {
+        const agentToml = parseToml(fs.readFileSync(path.join(agentsDir, files[0]), "utf8"));
+        result.agentId = agentToml?.id || files[0].replace(/\.toml$/, "");
+      }
+    }
+    const identityDir = path.join(installDir, "config", "identity");
+    if (fs.existsSync(identityDir)) {
+      const soulFiles = fs.readdirSync(identityDir).filter((f) => f.endsWith("-soul.md"));
+      for (const file of soulFiles) {
+        const content = fs.readFileSync(path.join(identityDir, file), "utf8");
+        const nameMatch = content.match(/^# Soul — (.+)$/m);
+        if (nameMatch) result.agentName = nameMatch[1].trim();
+        const operatorMatch = content.match(/^Operator:\s*(.+)$/m);
+        if (operatorMatch) result.userName = operatorMatch[1].trim();
+        if (result.agentName) break;
+      }
+    }
+    const providersDir = path.join(installDir, "config", "providers");
+    if (fs.existsSync(providersDir)) {
+      const providerFiles = fs.readdirSync(providersDir).filter((f) => f.endsWith(".toml") && f !== "ollama.toml");
+      if (providerFiles.length > 0) {
+        const name = providerFiles[0].replace(/\.toml$/, "").replace(/-codex$/, "");
+        result.provider = name === "openai" ? "openai" : name;
+      }
+    }
+  } catch {
+    // Non-fatal — fall back to defaults
+  }
+  return result;
+}
+
 function summarizeExistingConfig(installDir) {
   const runtime = readRuntimeConfig(installDir);
   const providersDir = path.join(installDir, "config", "providers");
@@ -164,19 +202,42 @@ async function runInteractiveWizard({
   flowOverride = null,
 }) {
   const prompter = createClackPrompter();
+
+  // ASCII banner — ANSI Shadow font, brand accent colour
+  const BRAND = "\x1b[38;2;45;212;191m";
+  const RESET = "\x1b[0m";
+  const DIM = "\x1b[2m";
+  const ascii = [
+    "",
+    `${BRAND}  ███╗   ██╗███████╗███╗   ███╗ ██████╗ ██████╗ ██╗███████╗${RESET}`,
+    `${BRAND}  ████╗  ██║██╔════╝████╗ ████║██╔═══██╗██╔══██╗██║██╔════╝${RESET}`,
+    `${BRAND}  ██╔██╗ ██║█████╗  ██╔████╔██║██║   ██║██████╔╝██║███████╗${RESET}`,
+    `${BRAND}  ██║╚██╗██║██╔══╝  ██║╚██╔╝██║██║   ██║██╔══██╗██║╚════██║${RESET}`,
+    `${BRAND}  ██║ ╚████║███████╗██║ ╚═╝ ██║╚██████╔╝██║  ██║██║███████║${RESET}`,
+    `${BRAND}  ╚═╝  ╚═══╝╚══════╝╚═╝     ╚═╝ ╚═════╝ ╚═╝  ╚═╝╚═╝╚══════╝${RESET}`,
+    "",
+  ].join("\n");
+  console.log(ascii);
+
   await prompter.intro("Nemoris setup");
 
   await prompter.note([
-    "Security warning — please read.",
+    "Nemoris is a personal AI agent runtime.",
+    "",
+    "Before continuing, please understand:",
     "",
-    "Nemoris runs as a background daemon on your machine.",
-    "It can execute shell commands, read files, and make network requests — always acting on your instructions, never autonomously.",
+    "  Your agent can execute system commands if tools are enabled.",
+    "  It can read and write files within its workspace directory.",
+    "  It can make network requests to configured providers.",
+    "  A malicious prompt could trick it into unsafe actions.",
     "",
-    "This is open-source software. Review the code at:",
-    "https://github.com/amzer24/nemoris",
+    "Recommended baseline:",
+    "  - Keep API keys out of the agent's reachable workspace.",
+    "  - Use the strongest available model for tool-enabled agents.",
+    "  - Review agent actions in the run log regularly.",
+    "  - Do not expose the daemon to untrusted networks.",
     "",
-    "Run as a personal agent — one trusted operator boundary.",
-    "Do not expose to the internet without hardening first.",
+    "More: https://github.com/amzer24/nemoris#security",
   ].join("\n"), "Security");
 
   const proceed = await prompter.confirm({
@@ -193,9 +254,9 @@ async function runInteractiveWizard({
     const action = await prompter.select({
       message: "Config handling",
       options: [
-        { value: "keep", label: "Use existing values" },
-        { value: "update", label: "Update values" },
-        { value: "reset", label: "Reset everything" },
+        { value: "keep", label: "Use existing values", hint: "Skip setup — keep current config and start running" },
+        { value: "update", label: "Update values", hint: "Walk through setup again, pre-filled with current config" },
+        { value: "reset", label: "Reset everything", hint: "Wipe and start fresh" },
       ],
     });
 
@@ -208,9 +269,9 @@ async function runInteractiveWizard({
       const scope = await prompter.select({
         message: "Reset scope",
         options: [
-          { value: "config", label: "Config only" },
-          { value: "config+state", label: "Config + state (memory, runs, scheduler)" },
-          { value: "full", label: "Full reset (everything)" },
+          { value: "config", label: "Config only", hint: "Rewrites agents, router, and provider config. Keeps memory and history." },
+          { value: "config+state", label: "Config + state", hint: "Config + wipes memory, run history, and scheduler data. Agent identities kept." },
+          { value: "full", label: "Full reset", hint: "Deletes everything and starts completely fresh. Like a first install." },
         ],
       });
       resetInstallArtifacts(installDir, scope);
@@ -247,12 +308,13 @@ async function runInteractiveWizard({
   const detection = await detect(installDir);
   await scaffold({ installDir });
 
+  const existing = readExistingIdentity(installDir);
   const userName = await prompter.text({
     message: "Your name",
-    initialValue: process.env.NEMORIS_USER_NAME || process.env.USER || "",
+    initialValue: existing.userName || process.env.NEMORIS_USER_NAME || process.env.USER || "",
     placeholder: os.userInfo().username || "",
   });
-  const defaultAgentName = process.env.NEMORIS_AGENT_NAME || resolveDefaultAgentName();
+  const defaultAgentName = existing.agentName || process.env.NEMORIS_AGENT_NAME || resolveDefaultAgentName();
   const agentName = await prompter.text({
     message: "What should your agent be called?",
     initialValue: defaultAgentName,
@@ -277,12 +339,30 @@ async function runInteractiveWizard({
       label: option.label,
       hint: option.hint,
     })),
-    initialValue: detectPreferredProvider({
+    initialValue: existing.provider || detectPreferredProvider({
       env: process.env,
       ollamaResult: detection.ollama ? { ok: true } : { ok: false },
     }),
   });
 
+  // Select auth method if provider has multiple options
+  let selectedAuthMethod = "api_key";
+  const providerOptions = detectProviderOptions({
+    env: process.env,
+    ollamaResult: detection.ollama ? { ok: true, models: detection.ollama.models } : { ok: false, models: [] },
+  });
+  const selectedProvider = providerOptions.find((o) => o.value === provider);
+  if (selectedProvider?.authMethods?.length > 1) {
+    selectedAuthMethod = await prompter.select({
+      message: `${selectedProvider.label} auth method:`,
+      options: selectedProvider.authMethods.map((m) => ({
+        value: m.value,
+        label: m.label,
+        hint: m.hint,
+      })),
+    });
+  }
+
   let authResult = { providers: [], providerFlags: {}, selectedModels: {} };
   let telegramResult = { configured: false, verified: false };
   let ollamaResult = { configured: false, verified: false, models: [] };
@@ -297,7 +377,7 @@ async function runInteractiveWizard({
         ollamaResult: detection.ollama ? { ok: true, models: detection.ollama.models } : { ok: false, models: [] },
       },
       providerOrder: [provider],
-      enableOpenAIOAuthChoice: provider === "openai",
+      authMethod: selectedAuthMethod,
     });
     authSpin.stop("Provider configured");
   }
@@ -359,27 +439,55 @@ async function runInteractiveWizard({
     installShellCompletion();
   }
 
-  const modelSummary = summarizeSelectedModels([
-    ...(authResult.selectedModels?.[provider] || []),
-    ...(ollamaResult.models || []).map((model) => `ollama/${model}`),
-  ]);
-  const authMethod = provider === "ollama"
-    ? "local"
-    : authResult.providers.length > 0
-      ? "api_key"
-      : "skipped";
+  const summaryLines = [];
+
+  // Providers
+  const providerNames = [];
+  if (authResult.providerFlags?.anthropic) providerNames.push("Anthropic");
+  if (authResult.providerFlags?.openai) providerNames.push("OpenAI");
+  if (authResult.providerFlags?.openrouter) providerNames.push("OpenRouter");
+  if (ollamaResult.configured || authResult.providerFlags?.ollama) providerNames.push("Ollama");
+  summaryLines.push(`Providers: ${providerNames.length > 0 ? providerNames.join(", ") : "none configured"}`);
+
+  // Models
+  for (const [prov, models] of Object.entries(authResult.selectedModels || {})) {
+    if (!models?.length) continue;
+    const stripped = models.map((m) => m.replace(/^(openrouter|openai-codex|anthropic)\//, ""));
+    summaryLines.push(`  ${prov}: ${stripped.join(", ")}`);
+  }
+
+  // Telegram
+  if (telegramResult.verified) {
+    summaryLines.push("Telegram: connected");
+  } else if (telegramResult.configured) {
+    summaryLines.push("Telegram: configured (not verified)");
+  }
 
-  await prompter.note([
-    "Auth overview:",
-    `  ${provider}  ${provider === "skip" ? "skip" : "✓"}  ${authMethod}`,
-    "",
-    "Models:",
-    `  Default  : ${modelSummary.defaultModel || "not configured"}`,
-    `  Fallback : ${modelSummary.fallbackModel || "not configured"}`,
-    "",
-    "Docs: https://github.com/amzer24/nemoris",
-    "Issues: https://github.com/amzer24/nemoris/issues",
-  ].join("\n"), "Ready");
+  // Ollama
+  if (ollamaResult.configured) {
+    summaryLines.push(`Ollama: ${ollamaResult.models?.length || 0} models`);
+  }
+
+  // Next steps
+  summaryLines.push("");
+  summaryLines.push("Next steps:");
+  summaryLines.push("  nemoris start        Start the daemon");
+  summaryLines.push("  nemoris status       Check runtime health");
+  summaryLines.push("  nemoris chat         Open TUI chat");
+
+  await prompter.note(summaryLines.join("\n"), "Setup complete");
+
+  try {
+    const pkg = JSON.parse(fs.readFileSync(new URL("../../package.json", import.meta.url), "utf8"));
+    writeWizardMetadata(installDir, {
+      lastRunVersion: pkg.version || "",
+      lastRunCommand: "setup",
+      lastRunMode: flow === "manual" ? "manual" : "quickstart",
+      lastRunFlow: "interactive",
+    });
+  } catch {
+    // Non-fatal
+  }
 
   await prompter.outro(
     telegramResult.verified
@@ -454,6 +562,19 @@ async function runNonInteractiveWizard({
   if (result.status === "warning") {
     return 1;
   }
+
+  try {
+    const pkg = JSON.parse(fs.readFileSync(new URL("../../package.json", import.meta.url), "utf8"));
+    writeWizardMetadata(installDir, {
+      lastRunVersion: pkg.version || "",
+      lastRunCommand: "setup",
+      lastRunMode: flow === "quickstart" ? "quickstart" : "manual",
+      lastRunFlow: "non-interactive",
+    });
+  } catch {
+    // Non-fatal
+  }
+
   if (flow !== "quickstart" && buildResult.ollamaConfigured) {
     // Keep manual mode deterministic in CI while preserving quickstart defaults.
     return 0;